{"openapi":"3.1.0","info":{"title":"Apizie","version":"2.0.0","description":"One API key, one envelope, many public data sources."},"servers":[{"url":"https://zieapi.vercel.app"}],"security":[{"ApiKeyAuth":[]}],"paths":{"/v1/cloud:aliyun-csasedr/describe-nsas-susp-event-type":{"post":{"operationId":"cloud_aliyun_csasedr_describe_nsas_susp_event_type","summary":"Queries security alert types","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"endpoint":{"type":"string","enum":["https://csasedr.ap-southeast-1.aliyuncs.com","https://csasedr.cn-shanghai.aliyuncs.com"],"default":"https://csasedr.ap-southeast-1.aliyuncs.com","description":"Regional endpoint, for example https://csasedr.ap-southeast-1.aliyuncs.com"},"SourceIp":{"type":"string","description":"The source IP address"},"Remark":{"type":"string","description":"The name or IP address of the server"},"Name":{"type":"string","description":"The name of the security alert type"},"Lang":{"type":"string","description":"The language of the request and response messages. Default value: zh. Valid values: zh: Chinese en: English"},"Uuids":{"type":"string","description":"The UUIDs of the servers. Separate multiple UUIDs with commas (,)"},"ContainerFieldName":{"type":"string","description":"The container field. This parameter is not supported by SASE-EDR"},"ContainerFieldValue":{"type":"string","description":"The value of the container field. This parameter is not supported by SASE-EDR"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-csasedr/describe-security-event-operations":{"post":{"operationId":"cloud_aliyun_csasedr_describe_security_event_operations","summary":"Queries the handling operations, operability, and whitelist rule configurations for a specified endpoint…","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["SecurityEventId"],"properties":{"endpoint":{"type":"string","enum":["https://csasedr.ap-southeast-1.aliyuncs.com","https://csasedr.cn-shanghai.aliyuncs.com"],"default":"https://csasedr.ap-southeast-1.aliyuncs.com","description":"Regional endpoint, for example https://csasedr.ap-southeast-1.aliyuncs.com"},"SecurityEventId":{"type":"integer","description":"The ID of the security alert event to be handled"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-csasedr/describe-susp-events":{"post":{"operationId":"cloud_aliyun_csasedr_describe_susp_events","summary":"Queries endpoint security alerts and supports filtering by alert, endpoint, and processing status","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"endpoint":{"type":"string","enum":["https://csasedr.ap-southeast-1.aliyuncs.com","https://csasedr.cn-shanghai.aliyuncs.com"],"default":"https://csasedr.ap-southeast-1.aliyuncs.com","description":"Regional endpoint, for example https://csasedr.ap-southeast-1.aliyuncs.com"},"Department":{"type":"string","description":"The department to which the user belongs"},"HostName":{"type":"string","description":"The name of the endpoint device"},"SrcIp":{"type":"string","description":"The IP address of the endpoint"},"UserName":{"type":"string","description":"The username of the endpoint"},"SourceIp":{"type":"string","description":"The IP address of the access source"},"Dealed":{"type":"string","description":"Filters alerts by processing group. Valid values: `N`: Pending. `Y`: Processed. `A`: All. If this parameter is not specified, all groups…"},"Name":{"type":"string","description":"The name of the asset affected by the alert event"},"Levels":{"type":"string","description":"The urgency levels of the alert events to query. Separate multiple urgency levels with commas (,). The urgency levels are listed in…"},"ParentEventTypes":{"type":"string","description":"The internal type identifiers of the alerts. Separate multiple types with commas (,). The valid values are derived from the current alert…"},"EventNames":{"type":"string","description":"The internal subtype identifiers of the alerts. Separate multiple subtypes with commas (,). This parameter is used to match event names.…"},"Remark":{"type":"string","description":"The alert name or asset information to query. Note: Fuzzy match is supported. Asset information includes the asset name, public IP…"},"Status":{"type":"string","description":"Further filters alerts by individual alert status within the processing group specified by the Dealed parameter. Status descriptions: `0`:…"},"PageSize":{"type":"integer","description":"The number of alert events to return on each page in a paging query. Default value: 20. Maximum value: 100"},"CurrentPage":{"type":"integer","description":"The page number of the returned page. Default value: 1"},"Lang":{"type":"string","description":"The language of the request and response. Default value: zh. Valid values: zh: Chinese. en: English"},"AlarmUniqueInfo":{"type":"string","description":"The unique ID of the alert event. To query the exception event information of a single alert event, you must provide the unique ID of the…"},"UniqueInfo":{"type":"string","description":"The unique key of the security alert"},"Id":{"type":"integer","description":"The unique ID of the recorded alert event"},"Source":{"type":"string","description":"The compatibility source classification parameter. This parameter is not used to specify the alert data source. You do not need to specify…"},"GroupId":{"type":"integer","description":"The ID of the group to which the asset affected by the alert event belongs"},"Uuids":{"type":"string","description":"The UUIDs of the servers for which you want to query alerts. Separate multiple UUIDs with commas (,)"},"ClusterId":{"type":"string","description":"The ID of the cluster for which you want to query alert events"},"ContainerFieldName":{"type":"string","description":"The container search field. Not supported by SASE-EDR"},"ContainerFieldValue":{"type":"string","description":"The value of the container search field. Not supported by SASE-EDR"},"TargetType":{"type":"string","description":"The container search target type. Not supported by SASE-EDR"},"TacticId":{"type":"string","description":"The ATT&CK tactic ID"},"OperateErrorCodeList":{"type":"string","description":"The collection of alert event processing result codes (JSON-encoded)"},"OperateTimeStart":{"type":"string","description":"The start time of the alert processing time. Specify a datetime string in the YYYY-MM-DD HH:mm:ss format"},"OperateTimeEnd":{"type":"string","description":"The end time of the alert processing time. Specify a datetime string in the YYYY-MM-DD HH:mm:ss format"},"TimeStart":{"type":"string","description":"The start time of the latest occurrence. Specify a datetime string in the YYYY-MM-DD HH:mm:ss format"},"TimeEnd":{"type":"string","description":"The end time of the latest occurrence. Specify a datetime string in the YYYY-MM-DD HH:mm:ss format"},"SortColumn":{"type":"string","description":"The custom sort field. Default value: operateTime. Valid values: lastTime: Latest occurrence time. operateTime: Processing time. This…"},"SortType":{"type":"string","description":"The custom sort order. Default value: desc. Valid values: asc: Ascending order. desc: Descending order. This field takes effect only when…"},"AssetsTypeList":{"type":"string","description":"The collection of asset types. Not supported by SASE-EDR (JSON-encoded)"},"StrictMode":{"type":"string","description":"Specifies whether the alert is in strict mode. Not supported by SASE-EDR"},"AlarmEventName":{"type":"string","description":"The name of the alert event"},"InnerIp":{"type":"string","description":"The private IP address of the endpoint device"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-csasedr/handle-security-events":{"post":{"operationId":"cloud_aliyun_csasedr_handle_security_events","summary":"Handles security alert events","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["SecurityEventIds","OperationCode"],"properties":{"endpoint":{"type":"string","enum":["https://csasedr.ap-southeast-1.aliyuncs.com","https://csasedr.cn-shanghai.aliyuncs.com"],"default":"https://csasedr.ap-southeast-1.aliyuncs.com","description":"Regional endpoint, for example https://csasedr.ap-southeast-1.aliyuncs.com"},"SecurityEventIds":{"type":"string","description":"The IDs of the security alert events to handle (JSON-encoded)"},"OperationCode":{"type":"string","description":"The operation code for handling the endpoint alert. Valid values: advance_mark_mis_info: Adds to the advanced whitelist.…"},"OperationParams":{"type":"string","description":"The operation parameters, represented as a JSON object string. If this parameter is not passed or an empty string is passed, the backend…"},"MarkMissParam":{"type":"string","description":"The JSON array string used when adding an advanced whitelist or precise defense whitelist rule. This parameter applies only when…"},"MarkBatch":{"type":"string","description":"Specifies whether to add to the whitelist in batches. Valid values: true: Yes. false: No"},"Remark":{"type":"string","description":"The remark for the handling operation"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}},"/v1/cloud:aliyun-csasedr/version":{"post":{"operationId":"cloud_aliyun_csasedr_version","summary":"version","description":"POST /","tags":["cloud"],"parameters":[],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","required":[],"properties":{"endpoint":{"type":"string","enum":["https://csasedr.ap-southeast-1.aliyuncs.com","https://csasedr.cn-shanghai.aliyuncs.com"],"default":"https://csasedr.ap-southeast-1.aliyuncs.com","description":"Regional endpoint, for example https://csasedr.ap-southeast-1.aliyuncs.com"}}}}}},"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RunEnvelope"}}}},"4XX":{"$ref":"#/components/responses/Error"},"5XX":{"$ref":"#/components/responses/Error"}},"x-apizie-cache-ttl":0,"x-apizie-min-plan":null,"x-apizie-bulk":false,"x-apizie-status":"byok"}}},"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"x-api-key"}},"schemas":{"RunEnvelope":{"type":"object","required":["project","data","timestamp"],"properties":{"project":{"type":"string","example":"dev-tools:hash"},"data":{},"timestamp":{"type":"string","format":"date-time"}}},"ErrorEnvelope":{"type":"object","properties":{"content":{},"message":{"type":"string"},"errors":{"type":"array","items":{}},"error":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"}}}}}},"responses":{"Error":{"description":"Invalid key, plan gate, rate limit or upstream failure","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorEnvelope"}}}}}}}